IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
7.5Yüksek

CVE-2026-42499Quadratic string concatenation in consumePhrase in net/mail

Go standard library net/mail; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat R… Yayım: (6 ay önce)

Açıklama

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Zayıflık türü (CWE): CWE-407CWE-1046

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
advanced cluster security 4.10 —
advanced cluster security 4.9 —
ansible automation platform 2.5 —
ansible automation platform 2.6 —
cert manager 1.19 —
edge manager 1.1 —
Go standard library net/mail < 1.25.10, 1.26.0-0 – < 1.26.3
golang go < 1.25.10
logging 6.0 —
logging 6.2 —
logging 6.4 —
logging 6.5 —
migration toolkit applications 8.1 —
migration toolkit applications 8.2 —
multicluster engine 2.11 —
openshift 4.12 —
openshift 4.13 —
openshift 4.14 —
openshift 4.15 —
openshift 4.16 —
openshift 4.17 —
openshift 4.18 —
openshift 4.19 —
openshift 4.20 —
openshift 4.21 —
openshift ai 2.25 —
openshift ai 3.4 —
openshift api data protection 1.3 —
openshift api data protection 1.4 —
openshift api data protection 1.5 —
openshift api data protection 1.6 —
openshift devspaces 3.30 —
quay 3.10 —
quay 3.12 —
quay 3.15 —
quay 3.16 —
quay 3.9 —
Red Hat Cert Manager support for Red Hat OpenShift release 1.19 all versions
Red Hat Logging for Red Hat OpenShift 6 all versions
Red Hat Logging for Red Hat OpenShift 6.2 all versions
Red Hat Logging Subsystem for Red Hat OpenShift 6.4 all versions
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 all versions
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 all versions
Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 all versions
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support all versions
Red Hat Red Hat Enterprise Linux 8 all versions
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service all versions
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support all versions
Red Hat Red Hat OpenShift Container Platform 4.12 all versions
Red Hat Red Hat OpenShift Container Platform 4.13 all versions
Red Hat Red Hat OpenShift Container Platform 4.14 all versions
Red Hat Red Hat OpenShift Container Platform 4.15 all versions
Red Hat Red Hat OpenShift Container Platform 4.16 all versions
Red Hat Red Hat OpenShift Container Platform 4.17 all versions
Red Hat Red Hat OpenShift Container Platform 4.18 all versions
Red Hat Red Hat OpenShift Container Platform 4.19 all versions
Red Hat RHEM 1.1 for RHEL 10 all versions
Red Hat RHEM 1.1 for RHEL 9 all versions
rhdh 1.10 —
rhdh 1.9 —
rhmt 1.8 —
service mesh 3.0 —
service mesh 3.1 —
service mesh 3.2 —
service mesh 3.3 —
trusted artifact signer 1.4 —
workload availability far 0.8 —
workload availability mdr 0.7 —
workload availability nhc 0.12 —
workload availability nmo 5.7 —
workload availability sbr 0.3 —
workload availability snr 0.13 —

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (2)
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* < 1.25.10
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* ≥ 1.26.0 < 1.26.3

Aynı üründe son açıklar — Go

6.8Orta
CVE-2026-111943

Distrust compromised intermediate certificates in crypto/x509

Go standard library crypto/x509

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in cr…

7.5Yüksek
CVE-2026-97032

HTTP/2 server crash due to HPACK encoder race in net/http

Go standard library net/http; Go standard library net/http/internal/http2; golang.org/x/net golang.org/x/net/http2

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part …

7.5Yüksek
CVE-2026-78660

HTTP/2 transport accepts malformed framing-related headers in net/http

Go standard library net/http; Go standard library net/http/internal/http2; golang.org/x/net golang.org/x/net/http2

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such header…

9.1Kritik
CVE-2026-78663

Double flow control refund on HTTP/2 server streams in net/http

Go standard library net/http; Go standard library net/http/internal/http2; golang.org/x/net golang.org/x/net/http2

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client…

7.5Yüksek
CVE-2026-78669

Excessive CPU consumption from repeated initial window changes in net/http

Go standard library net/http; Go standard library net/http/internal/http2; golang.org/x/net golang.org/x/net/http2

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.